Splunk Search

Using Search Commands in Data Objects

jgautreau
Explorer

Is there a way to use search commands like FillNull and/or Eval to clean up the data in a Data Object?

I have these commands working when i run searches but can not figure out how to applie them to my data object

1) I'm trying to add a column for openrates to a pivot - sourcetype="NMG _ Logfile" | stats count AS totalsent, count(eval(viewed>0)) AS "totalopens" | eval openrate = round(totalopens/totalsent,

2) I'm trying to fillin empty values in my data object | fillnull value=NULL

Thanks, John

jgautreau
Explorer

thanks - that is a big help 🙂

0 Karma

somesoni2
Revered Legend

|datamodel command: - after below syntax, you can use any regular search command like stats or fillnull.

    Syntax 
         |datamodel <DataModelName> <DataObjectName> search
Eg. 
    |datamodel Tutorial Successful_Purchase search | eval test="ABC"
   |datamodel Tutorial Successful_Purchase search | fillnull value=NULL categoryId

jgautreau
Explorer

when i use |datamodel, do i simply use it to create a root search object?

0 Karma

jgautreau
Explorer

thank you - big help

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...